email

AI Agent Phishing: Proofpoint’s New Defense

,

AI agents are now targets for email phishing, with cybercriminals exploiting prompts in emails to manipulate AI responses. Proofpoint introduced new AI defense tools to scan potential threats before they reach inboxes, enhancing email security. Traditional methods focus on known threats but fail against sophisticated attacks targeting AI systems. Proofpoint's real-time scanning aims to prevent AI exploitation pre-delivery by using refined detection models. The evolution of security must adapt to address these new risks as AI becomes more integrated into enterprise systems.

https://spectrum.ieee.org/ai-agent-phishing

Too Salty to Handle: Exposing Cases of CSS Abuse for Hidden Text Salting

Cisco Talos reports on hidden text salting in emails—using CSS to conceal irrelevant content for evasion of spam detection. The technique recently highlighted shows frequent use in spam versus legitimate messages. Four key areas where salt is inserted include the preheader, header, attachments, and body of emails. Common methods involve manipulating CSS properties like font size, visibility, and display, complicating detection efforts. Hidden text salting undermines email security solutions and requires enhanced filtering and detection strategies to mitigate risks effectively.

https://blog.talosintelligence.com/too-salty-to-handle-exposing-cases-of-css-abuse-for-hidden-text-salting/

Leaking the Email of Any YouTube User for $10,000

,

Leaking YouTube users' emails for $10,000 is possible due to a vulnerability involving their obfuscated Gaia IDs. By blocking a user on YouTube, their Gaia ID can be obtained, which can then be resolved to an email using an old Google product, Pixel Recorder. The exploit includes steps to leak the Gaia ID from YouTube, share a recording (without triggering notifications by using an excessively long title), and obtain the email linked to the user. Despite initial patches, the issue remained exploitable and was ultimately disclosed in early February 2025 after confirming fixes and receiving a total reward of $10,633 for the findings.

https://brutecat.com/articles/leaking-youtube-emails

Google’s DMARC Push Pays Off, but Challenges Remain

Google's DMARC initiative has doubled email authentication adoption, but 87% of domains remain vulnerable. Despite fewer unauthenticated emails, phishing threats persist, as attackers exploit domains with “lookalike” names. Increased regulation and standards drive further DMARC adoption. Organizations gain visibility into email failures with DMARC, aiding in better security classifications. Although adoption is rising, challenges in email security remain, emphasizing the need for continued improvement in cyber defenses.

https://www.darkreading.com/remote-workforce/google-dmarc-push-email-security-challenges

Seasoning Email Threats With Hidden Text Salting

Cisco Talos reports a rise in email threats using hidden text salting to evade detection. This technique involves inserting invisible characters or comments in the HTML of emails, confusing parsers and spam filters. It tricks systems into misidentifying brand names and languages in phishing attempts. Success against this method requires advanced detection strategies, inspecting suspicious CSS properties, and utilizing AI-driven email security solutions.

https://blog.talosintelligence.com/seasoning-email-threats-with-hidden-text-salting/

Scroll to Top